Kaspersky IDs Sophisticated New Malware Targeted at Air-Gapped Systems

guest · Jun 3, 2020

Kaspersky IDs Sophisticated New Malware Targeted at Air-Gapped Systems
'USBCulprit' is one of several tools - Cycldek group is more dangerous than previous assumed
June 3, 2020
https://www.darkreading.com/attacks...targeted-at-air-gapped-systems/d/d-id/1337998

A likely China-based threat actor called Cycldek, which security researchers have previously dismissed as a somewhat marginal group with relatively unsophisticated capabilities, may be considerably more dangerous than previously thought.

In a report this week, Kaspersky researchers describe finding numerous nuggets of, until now, unknown information suggesting that Cycldek operators have an extensive foothold in the networks of several high-profile targets in Vietnam, Laos, and Thailand.
Since at least 2018, the group (aka Goblin Panda and Conimes) has been using a variety of new tools, tactics, and procedures in attacks against government agencies in these countries, Kasperksy says.
Click to expand...

Among the new tools is one called USBCulprit, which appears designed for use in air-gapped environments where systems are not directly accessible from an external network.
The malware is programmed to copy itself selectively to certain USB drives so it can move laterally to other air-gapped systems each time an infected USB drive is inserted into one.

What is not clear, however, is the tactic that Cycldek operators are using to exfiltrate data from USBs. It's quite possible that copying data to the USBs is the end game and the attackers are manually collecting the drives later.
Click to expand...

Kaspersky: Cycldek: Bridging the (air) gap

Log in or Sign up

Kaspersky IDs Sophisticated New Malware Targeted at Air-Gapped Systems

guest Guest

Log in or Sign up

Kaspersky IDs Sophisticated New Malware Targeted at Air-Gapped Systems

guest Guest

Useful Searches